CVE-2026-5438 Orthanc Server CVE debrief

Who should care

Defenders responsible for Orthanc server configurations and deployments should assess exposure and prioritize verification and mitigation to prevent potential memory exhaustion attacks.

Why it matters

Defenders should prioritize verifying Orthanc server configurations and updating to version 1.12.11 or later to mitigate potential memory exhaustion attacks. This vulnerability may impact Orthanc server deployments that do not enforce limits on decompressed size when processing HTTP requests with `Content-Encoding: gzip`. The vulnerability's impact on system memory requires verification from official sources.

• Memory exhaustion attacks may occur if Orthanc server configurations do not enforce limits on decompressed size.
• Defenders should verify Orthanc server configurations to prevent potential memory exhaustion attacks.
• System memory may be exhausted if a specially crafted gzip payload is processed by the Orthanc server.

Technical summary

The Orthanc server does not enforce limits on decompressed size when processing HTTP requests with `Content-Encoding: gzip`, allowing a specially crafted gzip payload to trigger excessive memory allocation and exhaust system memory. This vulnerability may impact Orthanc server deployments that do not enforce limits on decompressed size. Defenders should prioritize verifying Orthanc server configurations and updating to version 1.12.11 or later to mitigate potential memory exhaustion attacks. The vulnerability's impact on system memory requires verification from official sources.

Defensive priority

Defenders should prioritize verifying Orthanc server configurations and updating to version 1.12.11 or later to mitigate potential memory exhaustion attacks.

Recommended defensive actions

• Verify Orthanc server configurations to ensure limits are enforced on decompressed size.
• Update Orthanc to version 1.12.11 or later.
• Monitor system memory usage for unusual patterns.
• Implement additional security measures to prevent potential memory exhaustion attacks.
• Review compensating controls for exposed systems while remediation is scheduled and verified.
• Check relevant monitoring, detection, and logs for exposed assets that need extra review.
• Track exceptions, retest remediated assets, and close the item only after evidence is documented.

Evidence notes

The vulnerability is described in the CVE and NVD records, with details on the gzip decompression bomb vulnerability in Orthanc. The NVD entry is currently Analyzed. Evidence limits are based on CVE and NVD records. Defenders should verify Orthanc server configurations to prevent potential memory exhaustion attacks. The CVE record was published on 2026-04-09T15:16:15.327Z and has not been modified since then.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.